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Quantum bit seal is a way to encode a classical bit quantum mechanically so that everyone 
can obtain non-zero information on the value of the bit. Moreover, such an attempt should have 
a high chance of being detected by an authorized verifier. Surely, a reader looks for a way to 
get the maximum amount of information on the sealed bit and at the same time to minimize 
her chance of being caught. And a verifier picks a sealing scheme that maximizes his chance of 
detecting any measurement of the sealed bit. Here, I report a strategy that passes all measurement 
detection procedures at least half of the time for all quantum bit sealing schemes. This strategy also 
minimizes a reader's chance of being caught under a certain scheme. In this way, I extend the result 
of Bechmann-Pasquinucci et al. by proving that quantum seal is insecure in the case of imperfect 
sealed bit recovery. 
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Introduction — We sometimes put an important doc- 
ument, such as a will, in an envelop with sealed wax so 
that others can open it only by breaking the wax. The 
intactness of the wax seal, therefore, shows that the doc- 
ument has not been opened. It is useful to extend the 
concept of physical wax seal to the digital world. Yet, no 
classical digital sealing scheme is unconditionally secure 
as one can, in principle, copy all the bits without being 
caught. 

Recently, Bechmann-Pasquinucci explored the possi- 
bility of sealing a classical bit quantum mechanically. In 
her scheme, each bit of classical message is encoded as 
three qubits out of which one of them is erroneous. Using 
single qubit measurement along the Standard basis plus 
the classical [3, 1, 3] 2 majority vote code, everyone can ob- 
tain the original classical bit with certainty. Moreover, an 
authorized verifier, who knows some extra information on 
the erroneous qubit, may check if someone has extracted 
the encoded classical bit with non-negligible probability 
Q. Following a similar line, Chau proposed quantum bit 
seal based on quantum error correcting code that applied 
to quantum messages Q. Recently, Singh and Srikanth 
as well as He jj, separately constructed quantum 
seals by extending the Bechmann-Pasquinucci protocol in 
different ways. In particular, He constructed a quantum 
bit string seal [jj. 

The above five quantum sealing schemes can be divided 
into two types. The first two are perfect quantum seals in 
the sense that a reader can obtain the classical message 
with certainty. The last three are imperfect for a reader 
cannot do so accurately. 

The density matrices used to encode any two distinct 
classical messages in a perfect quantum seal must be or- 
thogonal. Hence, one may devise a collective measure- 
ment to read out the sealed message without disturbing 
the encoded state. (A quantum computer may be re- 



quired to perform the collective measurement though.) 
This is precisely the idea used by Bechmann-Pasquinucci 
et al. to prové the insecurity of all perfect quantum seals 
[fj. However, their proof does not apply to imperfect 
seals. Therefore, it is instructive to study the security 
of imperfect seals. Recently, He analyzed the security of 
imperfect quantum bit seals and proved certain bounds 
regarding the information gain and the measurement de- 
tection probability 7]. However, his bound is not tight. 

In this Letter, I study the relation between the infor- 
mation on the sealed bit obtained by a reader and the 
probability of measurement detection by a verifier. In 
particular, I find a cheating strategy that obtains non- 
zero amount of information on the sealed bit but escapes 
detection at least half of the time for all quantum bit 
sealing schemes. Moreover, this strategy is optimal for a 
certain bit sealing scheme in the sense that no strategy 
with the same power of distinguishing the two sealed bits 
has a higher chance of avoiding measurement detection 
under that scheme. (Implementing this cheating strategy 
may require a quantum computer.) Consequently, I con- 
clude that all imperfect quantum bit seals are insecure. 

Quantum Bit Seal — A quantum bit seal is a method 
for Alice to encode a bit in such a way that any member 
of the públic, say Bob, can recover the original bit with 
probability greater than a half. Moreover, any recovery 
process must disturb the encoded state so that the intact- 
ness of the state plays the role of a wax seal. By checking 
its intactness, an authorized verifier may correctly detect 
any measurement of the value of the sealed bit with a 
certain non-zero probability. Without loss of generality, 
one may assume that the encoded state i Alice prepared 
is a pure state given by 
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for i — 0,1, where \tpij)'s are normalized states that are 
not necessarily mutually orthogonal, and |<^j)'s are or- 
thonormal states. (If the states prepared by Alice are 
mixed, she can always purify them. More importantly, 
the use of pure states increases the verifier's chance to 
detect a cheating Bob.) She makes the partides labeled 
by the subscript "B" publicly accessible, and keeps those 
labeled by the subscript "A" for authorized verifiers only. 
So, from Bob's point of view, the sealed state is either p 
or pi, where 



that 
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The maximum achievable classical L\ distance between 
probability distributions arising from measurements per- 
formed on po and p\ is equal to the trace distance between 
the two density matrices |8| 



D(po,Px) = ^Tr|p - pi| 
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The higher the value of g max , the higher the chance for 
Bob to correctly extract the sealed bit. In fact, a quan- 
tum bit seal is perfect if g max = 1; and it is imperfect if 
< g m ax < 1- (Actually, the case of g max = is not a 
quantum bit seal at all for it gives no information on the 
original state.) 

To gain information on the sealed state, Bob performs 
a positive operator-valued measure (POVM) measure- 
ment £ on the publicly accessible state. The classi- 
cal L\ distance between probability distributions aris- 
ing from the measurement £ on po and pi equals q = 
D(£(p ),£(pi)). From Alice's point of view, the entire 
cntangled state becomes £ <g> I(\tpi}(tjji\) = £ (\tpi) {ipi\) . 
Amongst all £ whose measurement results on po and p\ 
have the same classical L\ distance q 6 [0, ç max ], Bob 
would like to pick the one that minimizcs the chance of 
being detected by a verifier. Since it is equally likcly for 
the sealed bit to be or 1 and the probability of catching 
the reader Bob is at most equal to the fidelity of the re- 
sultant state as Bob's aim is equivalent to finding a 
quantum operation £ = £®I that maximizes the average 
fidelity 



min maxF(q, 
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for all < q < ç max and that 
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minmaxí 1 (0,g max ) = 1 
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The Optimal Cheating Strategy — Let me introduce 
a few notations before reporting the optimal cheating 
strategy that works for q > 0. (Note that this strategy 
is optimal in the sense stated in the above paragraph. 
That is to say, this is the best strategy for Bob to work 
against the most stringent sealing scheme devised by Al- 
ice. It is possible, however, to find a strategy with a 
higher value of average fidelity if Alice uses a less strin- 
gent scheme.) I write po — p\ = Qo — Qi, where Qi's 
are positive operators with orthogonal support. Suppose 
Ilo satisfying IloQo = Qo is a projector whose support 
is orthogonal to that of Qi, and let üi = / — üo be its 
complementary projector. (Clearly, these projectors ex- 
ist and are non-zero if and only if g max > 0. In addition, 
these non-zero projectors are uniquely determined on the 
support of po + pi if and only if po — p\ and po + p\ have 
a common support.) Then, the classical L\ distance be- 
tween probability distributions arising from the POVM 
measurement with measurement operators {Ilo, lli} on 
po an d pi equals q mSLX 0, E| . By denoting 



one has 



and 



a = (^o|n ®iïv>o) 



(^o|IIi ® I\iJ, ) = l- a , 
(•0i|n o <g> I\tj)\) = a-ç max 



(^ill·li <g> J|V>i) = l-a + q n 
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Clearly, ç max < a < 1. 

For any fixed < q < q max , let 
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On the other hand, Alice has the freedom to pick the seal- 
ing scheme. Of course, she would like to choose the one 
that minimizes F. Consequently, the average fidelity for 
the optimal cheating strategy minAiice maxBob F(q, <7max) 
is found by first taking the maximum over all possi- 
ble POVM measurements £ used by Bob with q = 
D(£ (g) I(p~o),£ <g) I(p~i)) for a given sealing scheme, and 
then by taking the minimum over all quantum bit seals 
with trace distance g max chosen by Alice. Here, I prové 
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Then M f M + M{Mi = I. So, the operation £ q ^ : 
given by 

{Pi) = M oPl Ml + M lPl M\ (13) 
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is a POVM measurement with D(£ q ^ qia ^(p ), £ q , q ^ x {pi)) 
= q. Bob applies this POVM measurement to the pub- 
licly accessible quantum partides and deduces the value 
of the sealed bit as i if the measurement outcome is i. 
(Bob may require a quantum computer in order to im- 
plcmcnt this measurement.) 

From Eqs. l(?j)- H12|) . the probability of correctly deter- 
mine the sealed bit equals 



Pr= (<^| Afí Afilli)) . = 



1 



(14) 



Similarly, the average fidelity of the resultant state 
caused by this cheating strategy is given by 



l 1 . 

F{q) = ^ E \$i\Mj®I\ï>i, 
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Note that F(q) attains its minimum value whcn a = 
(1 + Çmax)/2. More importantly, from the construction of 
H's, Alice may force a to take on the value (1 + g max )/2 
by choosing |^}'s in such a way that the supports of po — 
pi and po + pi agree and that (^ |n |^o) = (l + ç ma x)/2. 
(Such |^i)'s certainly exist. One possible choice is = 
{[1 + (-1)W]/2} 1 / 2 |0) B + {[1 - (-l)W]/2}V2|i) B 
for i — 0, 1.) Once Alice has picked such |V>i)'s, the av- 
erage fidelity of the resultant state after applying the 



POVM measurement £, 
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This F(q) sets the lower bound for the value of 
min A iicc maxBob F(q, g max ) in the case of q > 0. 

The Proof Of Optimality — I prové the optimality of 
the cheating strategy £q, 9max by explicitly constructing a 
quantum bit seal whose value of F(q) is upper bounded 
by the right hand side of Eq. HKifl for any cheating strat- 
egy used by Bob. I claim that 



V 1 - Qu 



: { [|o) B + (-iy|i) B ]®|o), 
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(17) 



for i = 0, 1 is such a scheme. 



Clearly, Pl = Tr A {\^)(^\) = diag([l + (-l)W]/2, 
[1 - (-l) I ç max ]/2). Thus, D(p , Pl ) = 9max . 

Recali that the most general measurement strategy for 
Bob is to perform a POVM measurement with measure- 
ment operators iV^'s, where 
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To qualify as a POVM measurement whose measurement 
results on po and p\ give probability distributions with 
classical L\ distance g, one requires 



i7ii 2 ) = i=E(i^i 2 + ^i 2 )' ( 19 ) 
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and 
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The average fidelity of the state after applying £ ÇlÇn 
equals 



F{q) = 



l+9n 



■E(Kl a + |íil 2 ) 
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The constraint in Eq. I|19|) implies that 

E(l^| 2 + I^| 2 )<2- (23) 

i 

And by constrained maximization, one concludes that 
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Consequently, F(q) for this scheme is less than or equal to 
the right hand side of Eq. (|16|l . Therefore, the optimality 
of £q,q max together with the validity of Eq. (0 are proven. 

It remains to consider the case of q = 0. In this case, 
Bob simply applies the identity operator to the state. 
Hence, minAiice niaxBob F(0, q max ) = 1. Note that the 
positive operators Qo and Q\ are non-zero if and only if 
Çmax > 0. The sudden change in the dimensions of Qi§ 
is probably the reason why minAiice niaxeob F(q, q max ) is 
discontinuous at (0,0). 

Discussions — In short, I have studied the relation 
between the information gain on the sealed qubit and 
the probability of sealed bit measurement detection. In 
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particular, I find a cheating strategy f g , 9max whose prob- 
ability of passing any measurement detection procedure 
is greater than or equal to the right hand side of Eq. ((Tü|l . 
Since this probability is at least 1/2, 1 conclude that both 
perfect and imperfect quantum bit scals are insecure. 
This strategy reduces to the one used by Bechmann- 
Pasquinucci et al. [|| in the case of a perfect seal. Morc 
importantly, the cheating strategy £ g , 9majt is optimal in 
the sense that it has the least possible chance of being 
dctcctcd by a. vcrifier for the most stringent quantum bit 
sealing scheme. Although all quantum states presented 
in this Letter live in finite dimensional Hilbert spaces, the 
arguments used in the proof are completely general and 
are applicable also to states living in infmite dimensional 
Hilbert spaces. 

At least two lines of followup researches are worth to 
conduct. One line is to investigate the security of imper- 
fect quantum bit string seal. Although one may apply 
the cheating strategy reported above to correctly read 
out a single bit in any quantum bit string seal with a 
small chance of being caught, the possibility (or impos- 
sibility) of correctly determining the vàlues of a large 
proportion of bits without being caught remains unclear. 
The other line of research is to look for a quantum bit 
sealing scheme whose security is based on computational 
(such as the inemciency in computing Qq and Qi) or 
hardware (such as the hardness of building a quantum 
computer) assumptions. 

Lastly, I remark that there is an irreparable gap in 



the "security proof" of the quantum seal in my earlier 
manuscript in Ref. Q — there is no way for Alice to 
force Bob to measure the publicly accessible qubits indi- 
vidually. 
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